# ENGINE STANDARDIZATION
> **Version**: 1.0 (2026-07-03)
> **Classification**: NEED_TO_KNOW
> **Location**: `Y:\documents\ENGINE_STANDARDIZATION.md` (LOCAL ONLY per OPS-09)
> **Source Code**: `Y:\669427\build-v2\` (LOCAL ONLY)
> **Cross-References**: [TOOLING_STANDARDIZATION.md](TOOLING_STANDARDIZATION.md), [PORT_STANDARDIZATION.md](PORT_STANDARDIZATION.md)

---

## Overview

The C++ Engine daemon (`sysd-engine`) is the **autonomous infrastructure brain** (per NET-10). It:

1. **Receives** HMAC-signed telemetry from all 8 nodes via bash tools
2. **Processes** payments (Stripe, XMR, USDT-TRC20, USDC-Polygon)
3. **Manages** the encrypted credential vault
4. **Runs** anomaly detection via Ollama/Mistral AI (SEC-10)
5. **Dispatches** commands back to s3rv1c3agent daemons on each node
6. **Logs** ALL operations to Engine DB (`engine` database)

---

## Architecture — End-to-End Communication

```
┌─────────────────────────────────────────────────────────────────┐
│                    ADMIN DASHBOARD (Origin)                     │
│                    PHP: EngineClient.php                        │
│                    Protocol: x-engine-* HMAC (dots)             │
│                    Key: /var/www/private/bridge_hmac.key         │
└──────────────────────────┬──────────────────────────────────────┘
                           │ HTTP/JSON via lantern (172.28.41.x)
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│              C++ ENGINE DAEMON (669427 / 10.69.69.6)            │
│              Binary: postfix-qmgr-aux (disguised per IDN-02)    │
│              Listens: 10.69.69.6:8301 (WG ONLY — NOT 0.0.0.0)  │
│              Namespace: node669427                               │
│              Process mask: [kworker/u4:2] (per IDN-01)          │
│              systemd: postfix-qmgr-aux.service (per IDN-05)     │
│                                                                  │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌────────────────┐     │
│  │ HttpSrvr │ │ Security │ │  Vault   │ │ ArtifactProc   │     │
│  │ port:8301│ │ Engine   │ │ AES-CBC  │ │ HMAC-protected │     │
│  └────┬─────┘ └────┬─────┘ └────┬─────┘ └────────────────┘     │
│       │            │            │                                │
│  ┌────┴────┐ ┌─────┴─────┐ ┌───┴────────┐ ┌─────────────┐     │
│  │ Crypto  │ │ Trust     │ │ Payment    │ │ Email       │     │
│  │ Engine  │ │ Scoring   │ │ Processor  │ │ Dispatcher  │     │
│  └─────────┘ └───────────┘ └────────────┘ └─────────────┘     │
└──────────────────────────┬──────────────────────────────────────┘
                           │ HTTP/JSON via wg7 (10.69.69.x)
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│              s3rv1c3agent (on each of 8 nodes)                  │
│              Each disguised per IDN-02 (see TOOLING_MAP.md)     │
│              Protocol: x-engine-* HMAC (dots) ← CANONICAL      │
│              Key: /dev/shm/engine_hmac.key (RAM only)           │
│              Tools: decrypt → /dev/shm → execute → shred        │
└─────────────────────────────────────────────────────────────────┘
```

---

## HMAC Protocol (Canonical — per CRY-02)

### Format: DOTS + METHOD+PATH binding (Canonical — updated 2026-07-03)
```
HMAC-SHA256( timestamp + "." + nonce + "." + METHOD + "." + path + "." + body )
```

**Why METHOD+path?** Prevents cross-endpoint replay attacks. An attacker who captures a valid `/health` signature cannot replay it against `/payment/init`.

**Why dots?** URL-safe, unambiguous parsing, no escaping needed. Colons (`:`) deprecated.

### Headers (Canonical)
```
x-engine-ts:    <unix_timestamp>
x-engine-nonce: <32-char hex>
x-engine-sig:   <64-char hex HMAC>
x-engine-node:  <6-digit NODE_ID>   (optional — for attribution)
```

### Who Sends / Who Validates

| Sender | Receiver | Current Format | Canonical Format | Status |
|--------|----------|---------------|-----------------|:------:|
| PHP Dashboard (EngineClient.php) | C++ Engine | ts.nonce.body (dots) | ts.nonce.METHOD.path.body | ⚠️ NEEDS METHOD+path added |
| Bash tools (all 13 svc*/mesh_*) | C++ Engine | ts.nonce.METHOD.path.body (dots) | ts.nonce.METHOD.path.body | ✅ FIXED 2026-07-04 |
| Bash se_client.sh | C++ Engine | ts.nonce.METHOD.path.body (dots) | ts.nonce.METHOD.path.body | ✅ Already compliant |
| Bash mesh_heartbeat.sh | Shield API | ts.nonce.METHOD.path.body (dots) | ts.nonce.METHOD.path.body | ✅ FIXED 2026-07-04 |
| Bash mesh_report.sh | Shield API | ts.nonce.METHOD.path.body (dots) | ts.nonce.METHOD.path.body | ✅ FIXED 2026-07-04 |
| Bash audit_logger.sh (SCLS) | C++ Engine | ts.nonce.METHOD.path.body (dots) | ts.nonce.METHOD.path.body | ✅ NEW 2026-07-04 |
| C++ Engine (signRequest) | PHP verify-hmac.php | ts.nonce.payload (dots) | ts.nonce.METHOD.path.body | ⚠️ NEEDS METHOD+path added |
| C++ Engine (validate_hmac) | — (receiver) | ts.nonce.body (dots) | ts.nonce.METHOD.path.body | ⚠️ NEEDS METHOD+path added |

> [!NOTE]
> **CL-HMAC-01 (RESOLVED 2026-07-04)**: All 13 bash tools converted to canonical dot format with METHOD+path binding.
> Tools fixed: svcfw, svcwatch, svcbeat, svcboot, svccfg, svcfile, svclock, svclog, svcperm, svcrotate, svctrap, mesh_heartbeat.sh, mesh_report.sh.
> Remaining: PHP Dashboard (EngineClient.php) and C++ Engine (validate_hmac) still need METHOD+path addition.
> New: audit_logger.sh (SCLS) deployed with canonical format from inception.

### HMAC Key Locations

| Layer | Key File | Notes |
|-------|----------|-------|
| C++ Engine | `/dev/shm/engine_hmac.key` | RAM-only, loaded at startup |
| PHP Dashboard | `/var/www/private/bridge_hmac.key` | Persistent on Origin disk |
| Bash tools | `/dev/shm/engine_hmac.key` | **MUST match C++ key** — NOT vault.key |

> [!IMPORTANT]
> **CL-KEY-01 (FIXED IN SPEC)**: Bash tools MUST use a dedicated HMAC key, NOT reuse the vault decryption key. Deploy `engine_hmac.key` to each node's `/dev/shm/` via compass tunnel on boot.

---

## HTTP API Endpoints

| Method | Path | HMAC Required | Handler | Purpose |
|--------|------|:-------------:|---------|---------|
| POST | `/artifact` | YES | handle_artifact() | Submit tool execution artifacts |
| GET | `/health` | NO | handle_health() | Liveness check (returns node_id, role, time) |
| GET | `/status` | NO | handle_status() | Full status (trust scores, sessions, vault) |
| POST | `/payment/init` | NO* | handle_payment_init() | Initiate payment (Stripe/XMR/USDT/USDC) |
| GET | `/payment/status/{id}` | NO* | handle_payment_status() | Check payment status |
| POST | `/email/send` | NO* | handle_email_send() | Dispatch email |
| POST | `/fulfillment/start` | NO* | handle_fulfillment_start() | Start fulfillment (Canada Post) |
| GET | `/security/events` | NO* | handle_security_events() | Get security event log |
| POST | `/ai/infer` | YES | handle_ai_infer() | Ollama/Mistral inference proxy |
| POST | `/api/audit/log` | YES (per-node key) | handle_audit_log() | SCLS encrypted audit ingest |
| GET | `/api/audit/list` | YES (admin) | handle_audit_list() | Paginated audit listing |
| POST | `/api/audit/decrypt` | YES (admin+rate) | handle_audit_decrypt() | On-demand decryption |
| GET | `/api/audit/stream` | YES (admin) | handle_audit_stream() | SSE real-time events |

> [!WARNING]
> Endpoints marked NO* lack HMAC enforcement in code. Per CRY-02 (CRITICAL), ALL mesh API calls MUST have HMAC. These endpoints are unprotected.

---

## Trust Scoring System (per ACC-07)

The SecurityEngine runs a continuous trust scoring loop:

```
Initial score: 50.0 (per IP)
Score range:   0.0 — 100.0

Adjustments:
  - Path probe (/admin, /.env, /wp-, /config): -15.0
  - Repeated path (>20 hits): -5.0
  - High RPS (>50 req/s): -10.0
  - Moderate RPS (>20 req/s): -5.0
  - Health/status check: +0.5
  - Idle >5 min: +2.0 (decay toward normal)

Thresholds:
  - trust < 25.0 → strike incremented
  - trust < 10.0 → AUTO BLOCK (session.blocked=true)
  - Blocked sessions → ALL future requests rejected
  - Idle >30 min (unblocked) → session expired/removed
```

### Logging
Every auto_block event logged to SecurityEngine events with severity=high.
Events queryable via GET `/security/events` → returns JSON array.
Admin Dashboard reads events via `EngineClient::getSecurityEvents()`.

---

## Vault Encryption (per CRY-01, CRY-05)

### Cipher: AES-256-CBC (Canonical)

```bash
# Encrypt (C++ engine_vault.cpp uses this via popen):
openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \
  -in plaintext.txt -out secret.vault \
  -pass file:/path/to/key

# Decrypt:
openssl enc -aes-256-cbc -d -salt -pbkdf2 -iter 100000 \
  -in secret.vault -pass file:/path/to/key
```

### File Format: `Salted__` + 8-byte salt + ciphertext
- Vault path: `/opt/apache/engine/vault/encrypted/`
- Key path: Configurable in `engine.conf` (default: vault_path + key file)
- Files: `*.vault` extension
- Cache: Decrypted values held in memory (`std::unordered_map`)
- Cleanup: `OPENSSL_cleanse()` on destructor — keys zeroed from RAM

> [!CAUTION]
> **CL-VAULT-01**: PHP config.php uses AES-256-GCM to decrypt. C++ uses AES-256-CBC. **PHP cannot read vault files.**
> Fix: Change PHP to CBC with PBKDF2 salt handling.

---

## Engine Config (engine.conf)

```json
{
  "node_id": "669427",
  "role": "ENGINE",
  "listen_port": 8301,
  "wg_interface": "wg7",
  "shield_ip": "10.69.69.1",
  "shield_port": 8302,
  "vault_path": "/opt/apache/engine/vault/encrypted",
  "db_host": "127.0.0.1",
  "db_name": "engine",
  "services": {
    "xmr_wallet_url": "http://127.0.0.1:18082/json_rpc",
    "xmr_daemon_url": "http://10.69.0.3:18081/json_rpc",
    "tron_signer_url": "http://127.0.0.1:9090",
    "stripe_bridge_url": "http://127.0.0.1:49629",
    "ollama_url": "http://127.0.0.1:11434"
  }
}
```

> [!CAUTION]
> **Stale IP**: `xmr_daemon_url` uses `10.69.0.3` — should be `10.69.69.x` if on WG mesh.

---

## C++ Source Structure (at `Y:\669427\build-v2\`)

```
build-v2/
├── engine/src/              ← Modular engine components
│   ├── engine_http.cpp      ← HTTP server + HMAC validation + routing
│   ├── engine_http.h        ← HttpServer class, HttpRequest struct
│   ├── engine_crypto.cpp    ← HMAC-SHA256, SHA-256, Base64, nonce gen
│   ├── engine_crypto.h      ← CryptoEngine class
│   ├── engine_security.cpp  ← Trust scoring, session tracking, anomaly detection
│   ├── engine_security.h    ← SecurityEngine class, Session struct
│   ├── engine_vault.cpp     ← AES-256-CBC vault decrypt + in-memory cache
│   ├── engine_vault.h       ← Vault class
│   ├── engine_config.cpp    ← Config file parser
│   ├── engine_config.h      ← NodeConfig struct (bind_address, ports, paths)
│   ├── engine_artifact.cpp  ← Artifact processing
│   ├── engine_payment.cpp   ← Stripe/XMR/USDT/USDC payment processing
│   ├── engine_email.cpp     ← Email dispatch (SMTP)
│   ├── engine_fulfillment.cpp ← Canada Post shipping integration
│   ├── main.cpp             ← Entrypoint, signal handling, process disguise
│   └── engine.conf          ← Runtime config
├── include/                 ← Legacy headers (bridge.hpp, common.hpp, etc.)
├── src/                     ← Legacy monolithic source (engine.cpp, http.cpp, etc.)
├── s3rv1c3agent/            ← Agent build system
│   ├── CMakeLists.txt       ← CMake build config
│   ├── build-agent.sh       ← Build script
│   ├── deploy-agent.sh      ← Deploy to nodes
│   ├── hello.sh             ← Session gate source (→ b2e0 per node)
│   └── s3rv1c3agent.service ← systemd unit template
├── dashboard/               ← PHP admin dashboard
│   ├── config.php           ← Vault decrypt + service endpoints
│   ├── EngineClient.php     ← HMAC-signed HTTP client → Engine API
│   ├── EngineHealth.php     ← Health monitoring dashboard
│   ├── PaymentBridge.php    ← Payment processing integration
│   └── WebhookHandler.php   ← Stripe webhook receiver
├── database/                ← SQL schemas
│   ├── 00-engine.sql        ← Engine DB tables
│   ├── 01-store.sql         ← Store DB tables
│   ├── 02-additions.sql     ← Schema additions
│   ├── 03-procedures.sql    ← Stored procedures
│   ├── 04-triggers.sql      ← DB triggers
│   ├── 05-users.sql         ← MySQL user grants
│   └── setup.sh             ← DB setup automation
└── deploy/                  ← Deployment
    ├── 669427.env            ← Environment config
    ├── firewall.rules        ← iptables rules
    ├── install.sh            ← Full install automation
    ├── verify-install.sh     ← Post-install verification
    └── update-origin.sh      ← Origin update script
```

---

## IDN Compliance (Per-Node Disguise)

### IDN-05: systemd Unit Disguise

| Rule | Expected | Actual | Status |
|------|----------|--------|:------:|
| Service name | `postfix-qmgr-aux.service` | `postfix-qmgr-aux.service` (in TOOLING_MAP) | ✅ |
| Description | Looks like Postfix helper | Needs verification on server | ⚠️ |
| Binary path | `/opt/apache/engine/tools/postfix-qmgr-aux` | Matches TOOLING_MAP | ✅ |
| Process name | Disguised | `[kworker/u4:2]` via `prctl(PR_SET_NAME)` + `argv[0]` rewrite | ✅ |

### IDN-07: No Human-Readable Node Names

**VIOLATIONS FOUND IN SOURCE CODE:**

| File | Count | Examples |
|------|:-----:|---------|
| direct-ip-detect.sh | 6 | "Shield", "Origin", "Engine", "DNS" in WG subnet comments |
| ce-engine-bridge.sh | 5 | "Engine Bridge", "Engine Report" in output strings |
| log_to_db.sh | 2 | "Origin" in comments |
| svcwatch | 1 | "Origin" in comment |
| telemetry-cron.sh | 1 | "Origin 10.69.69.2" in comment |
| data-integrity.sh | 2 | "Engine: MariaDB" in output |
| security-audit.sh | 2 | "Security Audit Engine" in description |
| **TOTAL** | **108** | Across 15+ files |

> [!CAUTION]
> **IDN-07 (CRITICAL)**: 108 human-readable node name violations across raw tools. All must be replaced with 6-digit NODE_IDs per rules.md.

---

## NET-01 Compliance (WG-Only Communication)

### PUBLIC IP VIOLATIONS

| File | IP | Node | Context |
|------|-----|------|---------|
| direct-ip-detect.sh | ALL 8 public IPs | All | Whitelist for direct-IP detection — **ACCEPTABLE** (detection tool needs to know public IPs) |
| mesh_heartbeat.sh:9 | 89.127.235.207 | Origin | API_BASE targets public IP — **VIOLATION** |
| mesh_report.sh:9 | 89.127.235.207 | Origin | API_BASE targets public IP — **VIOLATION** |

### STALE IP VIOLATIONS (10.69.0.x instead of 10.69.69.x)

| File | Count | Context |
|------|:-----:|---------|
| fleet_audit.sh | 5 | Node IPs: 10.69.0.3/4/5/6 |
| fleet_deploy.sh | 8 | Node IPs + ALLOWED_SOURCES |
| fleet_restart.sh | 7 | Node IPs |
| fleet_verify.sh | 5 | Node IPs |
| network-status.sh | 5 | FLEET_*_IP defaults |
| runtime-verify.sh | 5 | FLEET_*_IP defaults |
| security-password.sh | 1 | VAULT_NODE (10.69.0.5 → should be 10.69.69.8) |
| ce-domains.sh | 1 | PDNS_HOST |
| ce-engine-bridge.sh | 3 | VAULT_HOST, GHOST_HOST, PHOENIX_HOST |
| engine.conf | 1 | xmr_daemon_url (10.69.0.3) |
| **TOTAL** | **41** | |

---

## Cross-Layer Communication Flow

### Tunnel-Per-Purpose Communication (Updated 2026-07-03)

Each tunnel = one purpose = one log category. Engine DB stores separate audit trails per tunnel type.

```
LOG CATEGORIES IN ENGINE DB:

┌─────────────────────────────────────────────────────────────────┐
│ sec_ssh_sessions   ← wg7 tunnel (10.69.69.0/24)               │
│   hello check-in, goodbye, session metadata, SSH auth events   │
│   HMAC key: /dev/shm/wg7_session.key                           │
├─────────────────────────────────────────────────────────────────┤
│ sec_vault_calls    ← compass tunnel (172.28.47.0/28)           │
│   Key pulls, challenge-response, decrypt key requests          │
│   HMAC key: /dev/shm/compass_hmac.key                          │
├─────────────────────────────────────────────────────────────────┤
│ sec_tool_runs      ← forge tunnel (172.28.50.0/28)             │
│   Tool execution, artifacts, telemetry, log_to_db              │
│   HMAC key: /dev/shm/engine_hmac.key                           │
├─────────────────────────────────────────────────────────────────┤
│ sec_dashboard_ops  ← lantern tunnel (172.28.41.0/30)           │
│   Dashboard actions, admin commands, status polls              │
│   HMAC key: /var/www/private/bridge_hmac.key                   │
├─────────────────────────────────────────────────────────────────┤
│ sec_payment_events ← rain tunnel (172.23.83.0/30)              │
│   Payment initiation, Stripe webhooks, confirmations           │
│   HMAC key: /dev/shm/rain_hmac.key                             │
└─────────────────────────────────────────────────────────────────┘
```

### Tool Execution → Engine Logging (end-to-end)

```
1. SSH session opened on wg7 (10.69.69.x)
   └─ hello.sh check-in via wg7
   └─ LOGGED → sec_ssh_sessions (tunnel: wg7, key: wg7_session.key)

2. decrypt-run.sh pulls AES key from Vault via compass (172.28.47.x)
   ├─ HMAC-signed request to Vault (compass_hmac.key)
   ├─ Vault returns decryption key over compass tunnel
   └─ LOGGED → sec_vault_calls (tunnel: compass, key: compass_hmac.key)

3. Tool decrypted to /dev/shm, executes, sources common.sh

4. Tool reports results via forge (172.28.50.x) to Engine API
   ├─ se_curl_post() → http://172.28.50.1:8301/artifact
   ├─ HMAC: ts.nonce.METHOD.path.body (engine_hmac.key)
   ├─ Headers: x-engine-ts/nonce/sig/node
   └─ LOGGED → sec_tool_runs (tunnel: forge, key: engine_hmac.key)

5. decrypt-run.sh shreds plaintext (3-pass + unlink)

6. SSH session closed on wg7
   └─ goodbye via wg7
   └─ LOGGED → sec_ssh_sessions (tunnel: wg7, key: wg7_session.key)
```

**Forensic trace in Engine DB:**
```sql
-- "Show me everything node 333941 did in the last hour"
SELECT * FROM sec_ssh_sessions WHERE node_id='333941' AND ts > NOW()-3600;  -- SSH auth
SELECT * FROM sec_vault_calls  WHERE node_id='333941' AND ts > NOW()-3600;  -- key pulls
SELECT * FROM sec_tool_runs    WHERE node_id='333941' AND ts > NOW()-3600;  -- tool exec
-- Three clean audit trails, three different tunnels, three different keys
```

### Admin Dashboard → Engine → Node (command flow)

```
1. Admin logs into Dashboard (Origin, via Shield WG VPN, per NET-04)
2. Admin clicks action → EngineClient.php::doRequest()
   ├─ HMAC: ts.nonce.METHOD.path.body (bridge_hmac.key)
   ├─ Headers: x-engine-ts/nonce/sig
   └─ Target: http://172.28.41.2:8301 (via lantern tunnel)
   └─ LOGGED → sec_dashboard_ops (tunnel: lantern)
3. Engine validates HMAC → processes command
4. Engine dispatches to target node's s3rv1c3agent
   └─ Via: /cmd/recv endpoint over forge tunnel (172.28.50.x)
   └─ LOGGED → sec_tool_runs (tunnel: forge)
5. s3rv1c3agent executes TOOL_ID via decrypt-run.sh
   └─ Key pull from Vault → LOGGED → sec_vault_calls (tunnel: compass)
6. Result logged to Engine DB via forge
7. Dashboard polls /tool-audit or /security/events via lantern
```

### Payment Flow (per ACC-05, ENG-04)

```
1. Customer initiates payment on storefront
2. Request → Shield (pebble/timber tunnel) → Origin
3. Origin → EngineClient.php → Engine (lantern tunnel)
   └─ LOGGED → sec_dashboard_ops
4. Engine::PaymentProcessor::initiate()
   ├─ Stripe: via Stripe API (Payment node, rain tunnel)
   ├─ XMR: via local wallet RPC (127.0.0.1:18082)
   ├─ USDT-TRC20: via tron-signer (127.0.0.1:9090)
   └─ USDC-Polygon: via Polygon RPC
   └─ LOGGED → sec_payment_events (tunnel: rain)
5. Engine stores payment record in engine.payments
6. Engine responds to Origin with payment_id + status
7. Webhook → PaymentBridge (via rain tunnel) → Engine confirmation
   └─ LOGGED → sec_payment_events (tunnel: rain)
```

---

## Cross-Reference Matrix

| Document | What It Covers | Connects To |
|----------|---------------|-------------|
| **ENGINE_STANDARDIZATION** (this) | C++ daemon, HMAC protocol, trust scoring, vault cipher, API endpoints | TOOLING ↔ PORT ↔ WIREGUARD |
| **TOOLING_STANDARDIZATION** | Bash tools, decrypt pipeline, disguised names, TOOL_IDs, engine.json | ENGINE (API target) ↔ PERMISSIONS |
| **PORT_STANDARDIZATION** | Port assignments per node, firewall rules | ENGINE (8301) ↔ WIREGUARD (tunnels) |
| **PERMISSIONS_STANDARDIZATION** | SELinux, shadow immutability, boot persistence, file ownership | TOOLING (tool dirs) ↔ ENGINE (service unit) |
| **WIREGUARD_MAP** | Tunnel topology, subnets, ports, hub/spoke | ENGINE (lantern/rain) ↔ PORT (per-tunnel) |
| **IDENTIFICATION_MAP** | Node IDs, IPs, service accounts, SSH keys | ALL documents reference this |
| **TOOLING_MAP** | TOOL_ID registry, per-node disguised filenames | ENGINE (engine.json) ↔ TOOLING (deploy) |

### Communication Protocols Between Documents

```
TOOLING_STANDARDIZATION                    ENGINE_STANDARDIZATION
─────────────────────                      ──────────────────────
  engine.json (tool_map)  ─────────────→  Maps TOOL_ID → filename
  decrypt-run.sh          ─────────────→  Fetches AES key from Vault
  se_client.sh            ─────HMAC───→  validate_hmac() in engine_http.cpp
  log_to_db.sh            ─────SQL────→  Engine MySQL (sec_tool_runs)
  svcbeat                 ─────HTTP───→  Engine /health endpoint
  
PORT_STANDARDIZATION                       WIREGUARD_MAP
────────────────────                       ─────────────
  8301/tcp (Engine API)   ←────────────   lantern tunnel (Origin↔Engine)
  9922/tcp (SSH)          ←────────────   wg7 mesh (all nodes)
  42783/udp (compass)     ←────────────   compass tunnel (all↔Vault)
  
PERMISSIONS_STANDARDIZATION
───────────────────────────
  /opt/{disguise}/tools/  ←── root:root 700 ←── Tool deployment target
  /etc/shadow             ←── chattr +i    ←── svcwatch enforces
  /run/se/state/          ←── tmpfs 700    ←── Runtime state (hello.active)
```

---

## Compliance Summary vs rules.md

| Rule | Requirement | C++ Engine Status | Bash Tools Status |
|------|------------|:-----------------:|:------------------:|
| IDN-01 | Node identity disguised | ✅ `[kworker/u4:2]` process mask | ✅ Per-node naming |
| IDN-02 | Service disguise naming | ✅ `postfix-qmgr-aux` | ✅ Per TOOLING_MAP |
| IDN-05 | systemd unit disguised | ✅ `postfix-qmgr-aux.service` | ✅ Per-node units |
| IDN-07 | No human node names | ⚠️ Namespace `node669427` (OK) | ❌ **108 violations** |
| NET-01 | WG-only communication | ❌ **Binds 0.0.0.0** (INADDR_ANY) | ❌ 2 public IP targets |
| NET-08 | Non-standard ports only | ✅ Port 8301 | ✅ Port 9922 SSH |
| CRY-02 | HMAC on all inter-node | ✅ validate_hmac() on /artifact, /ai | ❌ **HMAC format mismatch** |
| CRY-04 | AES-256-CBC at rest | ✅ engine_vault.cpp | ❌ PHP uses GCM |
| ACC-01 | Session gate (b2e0) | ✅ hello.sh exists | ❌ **hello.active not created** |
| DEF-01 | svcwatch integrity | N/A (C++) | ✅ svcwatch deployed |
| OPS-05 | Mandatory logging | ✅ SecurityEngine events | ❌ **41 stale IPs** in tools |
